Matthias Vallentin

311 reputation

bio	website	matthias.vallentin.net
	location	Berkeley, CA
	age
visits	member for	1 year, 1 month
	seen	Mar 24 at 1:54
stats	profile views	11

I am PhD student at UC Berkeley where I develop distributed systems for:

Network Forensics
Incident Response
Large-Scale Intrusion Detection

	311 reputation	bio	website	matthias.vallentin.net	visits	member for	1 year, 1 month
24 badges		location	Berkeley, CA		seen	Mar 24 at 1:54

summary answers questions tags badges favorites bounties reputation activity

21 Actions

suggestions reviews revisions comments badges posts accepts all

Mar 22	awarded	Yearling
Feb 20	answered	non-periodic event detection
Jan 31	answered	How to tell if you're being ARP poisoned?
Nov 11	comment	Anomaly Intrusion Detection relevant features The security community highly discourages the use of the DARPA data set (and the derived KDD CUP) for any meaningful research. I recommend reading John McHugh's critique and Robin Sommer's paper on this topic.
Aug 21	awarded	Caucus
Aug 21	awarded	Constituent
Jul 7	answered	Can voice chat be spied?
Jul 3	comment	Pcap file inspection Have you tried to run them through Bro? The generated log files are quite comprehensive and may give you a clue.
May 23	comment	Published data sets for IDS/IPS evaluation Unfortunately I am not aware of any reasonable public data sets precisely because they are so difficult to create in the first place. For a NIDS, you could start with traffic traces of known attacks, but be aware that this is quite an isolated setting closer to unit testing. At a broader scope, it's highly valuable to evaluate IDSs in multiple environments and understanding why does it perform as it does, as complex detection algorithms may not always give an obvious answer to this question.
May 23	comment	Published data sets for IDS/IPS evaluation The IDS research community strongly discourages the use of the DARPA (and the derived KDD Cup) data set for any meaningful research. In general, it is non-trivial to generate such data sets: icir.org/vern/cs261n/papers/TISSEC-mchugh-critique.pdf.
Apr 2	comment	Stateful Signatures in an IPS Hopefully the added notes on scalability clarify this a bit. I do not use stateless signatures. Almost all important security incidents I come across are stateful. Also, signatures are essentially regular languages which are strictly inferior to the Turing-complete scripting language offered by NIDS like Bro.
Apr 2	awarded	Editor
Apr 2	revised	Stateful Signatures in an IPS Add notes on scalability.
Mar 31	answered	Stateful Signatures in an IPS
Mar 30	answered	monitoring outgoing network traffic
Mar 29	comment	Stateful Signatures in an IPS By asymmetric traffic, do you mean asymmetric routing in a multi-homed network?
Mar 29	comment	SSL with GET and POST To add a detail, the browser makes the destination host visible through the Server Name Indication (SNI) extension of TLS.
Mar 23	awarded	Supporter
Mar 23	comment	Implementation of an IDS While Bro used to be a "reasearch" NIDS in the early days, it is now a production-grade NIDS. Particularly the 2.0 release has significantly improved user friendliness. Many researchers still use it as a network research building block due to its robust TCP stream reassembler and its matured protocol analyzers. To better understand the NIDS architecture, I recommend reading the original Bro paper and the NIDS cluster paper.
Mar 23	awarded	Teacher